Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 05:42
Static task
static1
Behavioral task
behavioral1
Sample
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe
Resource
win7-20220414-en
General
-
Target
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe
-
Size
469KB
-
MD5
709802f0cfb676e53115189b5cd91cfc
-
SHA1
97027efdd9473b5f431179bc9b7ced86126cc625
-
SHA256
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3
-
SHA512
2e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
Processes:
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exeDesktopLayer.execaycwq.execaycwqSrv.exeDesktopLayer.exehrl3B1F.tmphrl3B1FSrv.exeDesktopLayer.exepid process 1428 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe 804 DesktopLayer.exe 904 caycwq.exe 1968 caycwqSrv.exe 1640 DesktopLayer.exe 1912 hrl3B1F.tmp 1044 hrl3B1FSrv.exe 972 DesktopLayer.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe upx C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe upx C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe upx behavioral1/memory/1428-61-0x0000000000400000-0x000000000042E000-memory.dmp upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/804-68-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Windows\caycwqSrv.exe upx C:\Windows\caycwqSrv.exe upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/1968-77-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx \Windows\Temp\hrl3B1FSrv.exe upx C:\Windows\Temp\hrl3B1FSrv.exe upx C:\Windows\TEMP\hrl3B1FSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/904-97-0x0000000002810000-0x0000000002889000-memory.dmp upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/1044-102-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx -
Loads dropped DLL 7 IoCs
Processes:
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.execaycwqSrv.execaycwq.exehrl3B1F.tmphrl3B1FSrv.exepid process 1400 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe 1428 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe 1968 caycwqSrv.exe 904 caycwq.exe 904 caycwq.exe 1912 hrl3B1F.tmp 1044 hrl3B1FSrv.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
caycwq.exedescription ioc process File opened (read-only) \??\S: caycwq.exe File opened (read-only) \??\U: caycwq.exe File opened (read-only) \??\W: caycwq.exe File opened (read-only) \??\G: caycwq.exe File opened (read-only) \??\H: caycwq.exe File opened (read-only) \??\K: caycwq.exe File opened (read-only) \??\M: caycwq.exe File opened (read-only) \??\R: caycwq.exe File opened (read-only) \??\F: caycwq.exe File opened (read-only) \??\L: caycwq.exe File opened (read-only) \??\N: caycwq.exe File opened (read-only) \??\P: caycwq.exe File opened (read-only) \??\V: caycwq.exe File opened (read-only) \??\X: caycwq.exe File opened (read-only) \??\Y: caycwq.exe File opened (read-only) \??\E: caycwq.exe File opened (read-only) \??\I: caycwq.exe File opened (read-only) \??\J: caycwq.exe File opened (read-only) \??\O: caycwq.exe File opened (read-only) \??\Q: caycwq.exe File opened (read-only) \??\T: caycwq.exe File opened (read-only) \??\Z: caycwq.exe -
Drops file in System32 directory 64 IoCs
Processes:
iexplore.execaycwq.exeiexplore.exeie4uinit.exeIEXPLORE.EXEdescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[3].ico iexplore.exe File created C:\Windows\SysWOW64\hra864.dll caycwq.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized iexplore.exe File created C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\L4IJB5AH.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KMOES3EA.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\S689IBUM.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{76A223F1-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{77975193-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].ico iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{76A223F1-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{76A223F1-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KO720F15.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\5ZQPHJNU.txt iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\imagestore\377s93u\imagestore.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\Favorites\desktop.ini iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\8BY1SYW0.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KMOES3EA.txt iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[2].ico iexplore.exe File created C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url\:favicon:$DATA iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\G1AZ224C.txt iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\suggestions[1].en-US iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 iexplore.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ie4uinit.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low iexplore.exe File opened for modification C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\1A854PCN.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\imagestore\377s93u\imagestore.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\8BY1SYW0.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{77975191-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\1A854PCN.txt iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\0WC01BNY.txt iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{82A59470-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\F3L7Q2GR.txt iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\Favorites iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{76A223F3-FAA8-11EC-82FC-726C518001C0}.dat iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ieonline.microsoft[1] iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low iexplore.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\E8DTOE7X.txt iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].ico iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low iexplore.exe -
Drops file in Program Files directory 9 IoCs
Processes:
caycwqSrv.exe3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exehrl3B1FSrv.execaycwq.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px3489.tmp caycwqSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe caycwqSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px3D4F.tmp hrl3B1FSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe hrl3B1FSrv.exe File created C:\Program Files\7-Zip\lpk.dll caycwq.exe File opened for modification C:\Program Files\7-Zip\lpk.dll caycwq.exe File opened for modification C:\Program Files (x86)\Microsoft\px2E42.tmp 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe -
Drops file in Windows directory 3 IoCs
Processes:
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.execaycwq.exedescription ioc process File opened for modification C:\Windows\caycwq.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe File created C:\Windows\caycwqSrv.exe caycwq.exe File created C:\Windows\caycwq.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
caycwq.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 caycwq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz caycwq.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363601185" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75E15491-FAA8-11EC-82FC-726C518001C0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36 iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046} IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF} iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e607070000000300080010003500ed0102000000e11a542af65b6546a8a3cfa9672e4291644ea2ef78b0d01189e400c04fc9e26e iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time = e607070000000300080010003000df02 iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = d0886645b58ed801 iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\Flags = "1024" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363601179" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type = "3" iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadNetworkName = "Network 3" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Time = e607070000000300080011000000f201 iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Blocked = "2" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e607070000000300080010003200ca0000000000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046} IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count = "1" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecisionReason = "1" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer iexplore.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
DesktopLayer.exeDesktopLayer.exeDesktopLayer.exepid process 804 DesktopLayer.exe 804 DesktopLayer.exe 804 DesktopLayer.exe 804 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 972 DesktopLayer.exe 972 DesktopLayer.exe 972 DesktopLayer.exe 972 DesktopLayer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exepid process 1400 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe -
Suspicious use of FindShellTrayWindow 17 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exepid process 1532 iexplore.exe 580 iexplore.exe 952 iexplore.exe 1532 iexplore.exe 580 iexplore.exe 1532 iexplore.exe 580 iexplore.exe 1532 iexplore.exe 1532 iexplore.exe 1532 iexplore.exe 580 iexplore.exe 580 iexplore.exe 580 iexplore.exe 580 iexplore.exe 580 iexplore.exe 1532 iexplore.exe 1532 iexplore.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 952 iexplore.exe 952 iexplore.exe 580 iexplore.exe 580 iexplore.exe 1532 iexplore.exe 1532 iexplore.exe 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1352 IEXPLORE.EXE 1352 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1352 IEXPLORE.EXE 1352 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exeDesktopLayer.execaycwq.execaycwqSrv.exeDesktopLayer.exeiexplore.exehrl3B1F.tmphrl3B1FSrv.exeDesktopLayer.exeiexplore.exeiexplore.exedescription pid process target process PID 1400 wrote to memory of 1428 1400 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe PID 1400 wrote to memory of 1428 1400 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe PID 1400 wrote to memory of 1428 1400 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe PID 1400 wrote to memory of 1428 1400 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe PID 1428 wrote to memory of 804 1428 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe DesktopLayer.exe PID 1428 wrote to memory of 804 1428 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe DesktopLayer.exe PID 1428 wrote to memory of 804 1428 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe DesktopLayer.exe PID 1428 wrote to memory of 804 1428 3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe DesktopLayer.exe PID 804 wrote to memory of 952 804 DesktopLayer.exe iexplore.exe PID 804 wrote to memory of 952 804 DesktopLayer.exe iexplore.exe PID 804 wrote to memory of 952 804 DesktopLayer.exe iexplore.exe PID 804 wrote to memory of 952 804 DesktopLayer.exe iexplore.exe PID 904 wrote to memory of 1968 904 caycwq.exe caycwqSrv.exe PID 904 wrote to memory of 1968 904 caycwq.exe caycwqSrv.exe PID 904 wrote to memory of 1968 904 caycwq.exe caycwqSrv.exe PID 904 wrote to memory of 1968 904 caycwq.exe caycwqSrv.exe PID 1968 wrote to memory of 1640 1968 caycwqSrv.exe DesktopLayer.exe PID 1968 wrote to memory of 1640 1968 caycwqSrv.exe DesktopLayer.exe PID 1968 wrote to memory of 1640 1968 caycwqSrv.exe DesktopLayer.exe PID 1968 wrote to memory of 1640 1968 caycwqSrv.exe DesktopLayer.exe PID 1640 wrote to memory of 580 1640 DesktopLayer.exe iexplore.exe PID 1640 wrote to memory of 580 1640 DesktopLayer.exe iexplore.exe PID 1640 wrote to memory of 580 1640 DesktopLayer.exe iexplore.exe PID 1640 wrote to memory of 580 1640 DesktopLayer.exe iexplore.exe PID 580 wrote to memory of 1656 580 iexplore.exe ie4uinit.exe PID 580 wrote to memory of 1656 580 iexplore.exe ie4uinit.exe PID 580 wrote to memory of 1656 580 iexplore.exe ie4uinit.exe PID 904 wrote to memory of 1912 904 caycwq.exe hrl3B1F.tmp PID 904 wrote to memory of 1912 904 caycwq.exe hrl3B1F.tmp PID 904 wrote to memory of 1912 904 caycwq.exe hrl3B1F.tmp PID 904 wrote to memory of 1912 904 caycwq.exe hrl3B1F.tmp PID 1912 wrote to memory of 1044 1912 hrl3B1F.tmp hrl3B1FSrv.exe PID 1912 wrote to memory of 1044 1912 hrl3B1F.tmp hrl3B1FSrv.exe PID 1912 wrote to memory of 1044 1912 hrl3B1F.tmp hrl3B1FSrv.exe PID 1912 wrote to memory of 1044 1912 hrl3B1F.tmp hrl3B1FSrv.exe PID 1044 wrote to memory of 972 1044 hrl3B1FSrv.exe DesktopLayer.exe PID 1044 wrote to memory of 972 1044 hrl3B1FSrv.exe DesktopLayer.exe PID 1044 wrote to memory of 972 1044 hrl3B1FSrv.exe DesktopLayer.exe PID 1044 wrote to memory of 972 1044 hrl3B1FSrv.exe DesktopLayer.exe PID 972 wrote to memory of 1532 972 DesktopLayer.exe iexplore.exe PID 972 wrote to memory of 1532 972 DesktopLayer.exe iexplore.exe PID 972 wrote to memory of 1532 972 DesktopLayer.exe iexplore.exe PID 972 wrote to memory of 1532 972 DesktopLayer.exe iexplore.exe PID 952 wrote to memory of 1352 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1352 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1352 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1352 952 iexplore.exe IEXPLORE.EXE PID 580 wrote to memory of 1344 580 iexplore.exe IEXPLORE.EXE PID 580 wrote to memory of 1344 580 iexplore.exe IEXPLORE.EXE PID 580 wrote to memory of 1344 580 iexplore.exe IEXPLORE.EXE PID 580 wrote to memory of 1344 580 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1348 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1348 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1348 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1348 1532 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe"C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exeC:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\caycwq.exeC:\Windows\caycwq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\caycwqSrv.exeC:\Windows\caycwqSrv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon5⤵
- Drops file in System32 directory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:340993 /prefetch:25⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\TEMP\hrl3B1F.tmpC:\Windows\TEMP\hrl3B1F.tmp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\hrl3B1FSrv.exeC:\Windows\TEMP\hrl3B1FSrv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:26⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L50TZFUX.txtFilesize
608B
MD5e5674237e015bb33fc38e6ee95abff57
SHA12585e0bac798082f6a9ff3a5c2bed1d63b0dd393
SHA256ee3b4acad94089468291300aa0b682bd24db3a28b48d2f0d7cf8f8c69685506a
SHA512ba59b3b73763a0eb44e1b303138627030902374062d243f4fd53439df81b1fa277daa82e610a4790a8a4d2cdb927a23320aeb9cac4984fabd8380a70b5e6768e
-
C:\Windows\System32\config\systemprofile\Favorites\desktop.iniFilesize
402B
MD5881dfac93652edb0a8228029ba92d0f5
SHA15b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
-
C:\Windows\TEMP\hrl3B1FSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Windows\Temp\hrl3B1F.tmpFilesize
469KB
MD5709802f0cfb676e53115189b5cd91cfc
SHA197027efdd9473b5f431179bc9b7ced86126cc625
SHA2563cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3
SHA5122e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e
-
C:\Windows\Temp\hrl3B1FSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Windows\caycwq.exeFilesize
469KB
MD5709802f0cfb676e53115189b5cd91cfc
SHA197027efdd9473b5f431179bc9b7ced86126cc625
SHA2563cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3
SHA5122e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e
-
C:\Windows\caycwq.exeFilesize
469KB
MD5709802f0cfb676e53115189b5cd91cfc
SHA197027efdd9473b5f431179bc9b7ced86126cc625
SHA2563cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3
SHA5122e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e
-
C:\Windows\caycwqSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Windows\caycwqSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{76A223F1-FAA8-11EC-82FC-726C518001C0}.datFilesize
3KB
MD52e508482da3cda475810663dfbd97b6e
SHA168cfaf145c5307e1206223352c5401009cf4df7a
SHA256447e89a3495d756948c3a60c5a4fc300f480009cd7789fa0e6b9a51a17faec69
SHA512c899dcd99a7e2448300afcef0d1824468a6c96035f8d065e6da79512b42f08b9d024849d050d0c08467bfd30c7b1eebf95134f65f9e21849844b8ce8ac8bb6c7
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{77975191-FAA8-11EC-82FC-726C518001C0}.datFilesize
3KB
MD5b033770aa2a8e5e6fa695ee6da1d885b
SHA1bd220b2a5855d7ff8836f8f06613071cc7c17da4
SHA256cd590552fbcbba21374d08683f42945012198504700959df91bf39f363fb73e0
SHA51201e62827a3a06905a13c21666af80be45b6adbb66fec11639769db6e268f96f02bf50dc636dc9714a8fc7fb5c34ff7b48f44926103265dd3114e9dbc4b68f495
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\3cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Windows\SysWOW64\hra8.dllFilesize
482KB
MD5c557b3eb2cfc0f897ef106d909e8fcd1
SHA1edb013dcd2071f87529de64c13eb8cf8c8c9cd94
SHA2561277b91193b0d5271a6030d0a1dcc23de6f497120a6e73549d4996009fa92e58
SHA5128e6d9c3b69d3703763cadaa47147865d801cdbe952f36ebc6b1764bdc4a32267d017fa7eccdd846da8a2496d2e30b4d9487c06a3db4b7bc70f8a874b65c7869d
-
\Windows\Temp\hrl3B1F.tmpFilesize
469KB
MD5709802f0cfb676e53115189b5cd91cfc
SHA197027efdd9473b5f431179bc9b7ced86126cc625
SHA2563cabd6b4edbffa940ed1080ab93015ed89a5d1ab228e5008677de63dbd2fbbe3
SHA5122e7fd447ecfdb6bb53dce4e7d560881ecfbe036b5dd2c20414fb76c792653ca40a2b9774cc40ee074d3a4c0a340521bf120a93d174c3c69ce2fb562412ba951e
-
\Windows\Temp\hrl3B1FSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/804-64-0x0000000000000000-mapping.dmp
-
memory/804-68-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/904-81-0x0000000000480000-0x00000000004AE000-memory.dmpFilesize
184KB
-
memory/904-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/904-80-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/904-97-0x0000000002810000-0x0000000002889000-memory.dmpFilesize
484KB
-
memory/972-98-0x0000000000000000-mapping.dmp
-
memory/1044-100-0x00000000001C0000-0x00000000001CF000-memory.dmpFilesize
60KB
-
memory/1044-102-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1044-91-0x0000000000000000-mapping.dmp
-
memory/1400-60-0x00000000002D0000-0x00000000002FE000-memory.dmpFilesize
184KB
-
memory/1400-59-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1428-62-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/1428-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1428-57-0x0000000075E41000-0x0000000075E43000-memory.dmpFilesize
8KB
-
memory/1428-55-0x0000000000000000-mapping.dmp
-
memory/1640-75-0x0000000000000000-mapping.dmp
-
memory/1656-82-0x0000000000000000-mapping.dmp
-
memory/1656-84-0x000007FEFB851000-0x000007FEFB853000-memory.dmpFilesize
8KB
-
memory/1912-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1912-88-0x0000000000000000-mapping.dmp
-
memory/1968-77-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1968-70-0x0000000000000000-mapping.dmp